Notes on internal control in Cuba

In Cuba, the Economic Resolution of the V Congress of the Communist Party of Cuba states:

"… In the new conditions in which the economy operates, with a greater degree of decentralization and more linked to the demands of international competition, the timely and effective control of economic activity is essential for management at any level…" and more later it is specified.

"… An indispensable condition in all this process of transformation of the business system will be the implementation of strong financial restrictions that make the control of the efficient use of resources internal to the management mechanism and not solely dependent on external verifications…".

For a long time the scope of the Internal Control system was limited to economic areas, there was talk of Internal Control and there was a culture that it was inherent in accounting and finance activities; the rest of the operational areas and in fact their workers did not feel involved. Not all the managers of our organizations saw in the Internal Control system a management instrument capable of being used to achieve the efficiency and effectiveness of the operations that had been proposed. Another element that threatened the efficiency of the Internal Control systems was that the control activities had already been established globally for all the entities in the country,minimizing the creativity of the managers in the design of the objectives and control activities that were more effective according to the characteristics of their entity. In addition, there were no generalizing elements that would serve as a basis for the organization to design an Internal Control system tailored to their needs.

Such situation materialized a fundamental objective: to define a new conceptual framework of Internal Control, capable of integrating the various definitions and concepts that were being used on this subject, thus achieving, at the level of organizations, internal or external auditing, or from the academic or legislative levels, there is a common conceptual framework, and an integrating vision that meets the demands of all the entities involved. In this sense, the Ministry of Finance and Prices puts into effect Resolution No. 297 of 2003, which includes the definition of Internal Control, the content of the components and the rules for its implementation and evaluation.

1.1.- Background

Internal Control has been a concern of the entities, to a greater or lesser degree, with different approaches and terminologies, which has allowed different conceptions of Internal Control, its principles and elements to be known over time, to be considered and implement in the current Cuban entity.

1.2.-Need and importance of the topic

Internal control is an effective instrument to achieve efficiency and effectiveness in the work of entities. The development of new terms related to Internal Control, unlike what was previously identified, that is, only accounting. The introduction of new questions that contribute generalizing elements for the elaboration of the Internal Control Systems in each entity.

1.3.-Obligation

The Internal Control Systems of each entity, from the study of its characteristics, must establish its actions and internal control measures and must be complied with by all the people involved and responsible for its operation. It is applicable to the entire Business System of the country, the budgeted units, the National Banking System and the Cooperative Sector, hereinafter entities. Procedures manuals must be prepared taking into account the criteria established in the General Internal Control Standards.

1.4.- Definition of Internal Control

It is the process integrated to the operations carried out by the management and the rest of the personnel of an entity to provide reasonable security to the achievement of the following objectives:

Reliability of the information. Efficiency and effectiveness of operations. Compliance with established laws, regulations and policies. Control of resources, of all kinds, available to the entity.

1.5.-General characteristics of Internal Control

It is a process, that is, a means to achieve an end and not an end in itself. It is carried out by people who act at all levels and it is not just about organization manuals and procedures. In each area of the organization, the person in charge of directing it is responsible for the Internal Control before its immediate boss according to the levels of authority established in its compliance, all the workers of the entity participate regardless of their occupational category. They must facilitate the achievement of objectives in a or more of the areas or operations in the company. It provides a reasonable degree of security, although not total, in relation to the achievement of the objectives set. It must tend to achieve self-control, leadership and strengthening of the authority and responsibility of the groups work.

The Internal Control System in small entities, establishments and base units, should be simple, with the use of few workers who handle and process little information, foreseeing that the top manager or someone designated by him, be responsible for the review and supervision of operations.

1.6.-Limitations of internal control

The concept of Reasonable Security is related to the explicit recognition of the existence of inherent limitations of Internal Control.In the performance of controls, errors may be made as a result of erroneous interpretations of instructions, errors of judgment, carelessness, distraction and fatigue. Controls depending on the separation of functions, can be circumvented by collusion between workers, that is, agree to harm third parties. The extent of the controls adopted in an organization is also limited by cost considerations, therefore, it is not feasible to establish controls that provide absolute protection from fraud and waste, but to establish controls that guarantee reasonable security from the point of view of costs.

1.7.- Internal Control Components and their Standards

The process characteristic, assigned in the concept of internal control, refers to the fact that its elements are integrated with each other and implemented interrelatedly, influenced by the management style.

Adopting more advanced and rigorous systems, assimilable by the economy of the entities, will also influence the management style, taking into account that our entities are not subject to a single owner or a small group of them and that, therefore, they are obligated to a necessary feedback of the internal control systems and of the provisions and regulations established by the competent organs and agencies of the State.

The components of the control are:

Control environment. Risks evaluation. Control Activities. Information and communication. Supervision or Monitoring.

These definitions of the Internal Control components, with a strategic focus on the development of the entities, must include norms or procedures of a general nature to be considered in the design of the Internal Control Systems in each entity, accompanied by control criteria and evaluation in some areas of the organization.

1.8.-Standards by Components

First Standard: Integrity and Ethical Values

Second Standard: Professional competence

Third Standard: Atmosphere of mutual trust

Fourth Standard: Organizational chart

Fifth Standard: Assignment of authority and responsibility

Sixth Standard: Policies and practices in personnel

Seventh Standard: Control Committee

First Standard: Identification of risk

Second Standard: Estimation of risk

Third Standard: Determination of control objectives

Fourth Standard: Detection of change.

First Rule: Separation of tasks and responsibilities

Second Rule: Coordination between areas

Third Rule: Documentation

Fourth Rule: Defined levels of authorization

Fifth Rule: Timely and adequate registration of transactions and events

Sixth Rule: Restricted access to resources, assets and records

Seventh Standard: Rotation of personnel in key tasks

Eighth Standard: Control of the information system

Ninth Standard: Control of information technology

Tenth Standard: Performance indicators

Eleventh Standard: Independent Internal Audit Function

First Standard: Information and responsibility

Second Standard: Content and flow of information

Third Standard: Information quality

Fourth Standard: Flexibility to change

Fifth Standard: The information system

Sixth Standard: Management commitment

Seventh Standard: Communication, values of the organization and strategies

Eighth Standard: Communication channels

This work focuses its fundamental objective on the Supervision and Monitoring component made up of five standards which we will develop below.

1.9.-Supervision and Monitoring

1.9.1 First rule: Evaluation of the Internal Control System

1.9.2 Second rule: Efficiency of the Internal Control System

1.9.3 Third rule: Audits of the Internal Control System

1.9.4 Fourth rule: Validation of the assumptions assumed

1.9.5 Fifth rule: Treatment of detected deficiencies

1.9.1.-First rule: Evaluation of the Internal Control System

Managers at any level of the organization must periodically evaluate the effectiveness of the Internal Control system and communicate the results of this evaluation. Carrying out a periodic analysis of the way in which this system is operating will provide the person in charge with the tranquility of proper operation, or the opportunity to correct and strengthen it. The entities must take into account the aforementioned in their operation, as well as other mechanisms for analyzing their functions.

1.9.2.- Second rule: Efficiency of the Internal Control System

The Internal Control System is considered effective to the extent that the authority it supports has reasonable security in:

Information about progress in achieving its objectives and goals and in using economy and efficiency criteria. The reliability and validity of the reports and financial statements. Compliance with current legislation and regulations, including the policies and procedures inherent to the entity.

Once the Internal Control techniques have been identified and applied, the process for evaluating their effectiveness should begin when these techniques are judged under the following terms:

They give reasonable assurance that the control objective is achieved. They give reasonable assurance that the control objective is partially achieved. They do not give assurance that control objectives are achieved.

The conclusion that an Internal Control objective is achieved means that there is reasonable certainty that significant errors or fraud can be prevented or discovered in a timely manner. The conclusion that an objective is not achieved or is partially achieved indicates that such reasonable certainty does not exist and, therefore, errors or fraud may occur that would not be discovered and corrected by routine execution of techniques implemented by the organization., with the consequent danger of latent risks.

1.9.3.- Third rule: Audits of the Internal Control System

Audits must be carried out, which will report on the effectiveness and efficiency of the Internal Control System, providing recommendations for its strengthening. These exams, carried out on the basis of generally accepted norms and procedures, allow obtaining a reasonable opinion on the state and operation of an Internal Control System.

The nature, extent and frequency of evaluations of the Internal Control System should vary depending on the level of risk determined and the weight of the importance of control to reduce it. The audit must follow an objective and systematic method that, reasonably, increases the probability of the formation of a correct judgment. For this it is important that:

An internal auditing apparatus has been created, or failing that, systematic checks of the activities are carried out by specialists directly or not directly related to the function being audited to determine how these are carried out. follow up on each of the rules and procedures that were proposed in the analysis of job descriptions, job cycle, operations and areas. Internal auditors achieve a high level of professionalism that allows them to carry out their work with quality, always maintaining their level of independence. The internal auditors and the members of the Control Committee may raise their considerations with the Board of Directors.The scope and plans of the internal audit are focused on creating a culture of prevention in the entity.

1.9.4.- Fourth rule: Validation of the assumptions assumed

An entity's objectives and the control elements that support its achievements rest on fundamental assumptions about how its environment works. Managers must periodically validate the assumptions that form the basis of the organization's objectives and control techniques to achieve those objectives.

Validation of the assumptions about how the system works is done with the interest of analyzing the effectiveness of the established control techniques, checking if these assumptions are known to the entire organization and their capacity to adapt to changes. If the assumptions of an organization are not valid, they should be periodically revalidated and focus on new control strategies and techniques that support the interests of the organization. Assumptions about how the system works are often widely held in an organization, although staff may be unaware of them.

Such unconscious assumptions can inhibit the ability to adapt to change, because they lead staff to discard all information that does not fit their concepts. An open dialogue is needed to identify the assumptions. If an organization's assumptions are invalid, control can be ineffective, so periodic revalidation of the organization's assumptions is key to control effectiveness. The extent to which training seminars, planning sessions or other meetings provide information to management on whether controls work or not, including the understanding of each of them by workers, should be studied, therefore:

It is periodically assessed by both the Human Resources area and by the Board of Directors, if the topics covered are in correspondence with the fundamental incidents of the entity. Take into account the suggestions of the workers on any operating initiative, in correspondence with the Problems of the entity in its performance. Listening in the affiliate assemblies or other meetings or contacts with the workers their opinions on the guidelines and training needs, to bring to them what they really need, and not a program to fulfill a plan of training; and even on the discipline and ethics of workers and leaders.

1.9.5.- Fifth rule: Treatment of detected deficiencies

Any deficiency that affects or could affect the effectiveness of the Internal Control System must be reported. Procedures should be established to determine on what matters, in what form and to whom such information will be presented. The deficiencies in the functioning of the Internal Control System, given their importance, must be quickly detected and communicated.

The term deficiency should be understood broadly; that is, any condition within the system that is worthy of attention. The identification of deficiencies can arise from different sources: Internal Control itself, supervision and evaluation. Also, through the relationship with third parties, through claims, demands, etc.

The communication of deficiencies should normally follow the path that leads to the immediate superior; But the general orientation should be that you finally reach the authority that can take corrective action. A case that can serve as an example is one in which the detected problem invades the organizational limits; here communication must be directed at a level high enough to ensure appropriate action.

Internal Control deficiencies must be reported to higher levels and the most significant must be presented to senior management and the board of directors. That is why the identified Internal Control deficiencies must consider:

The existence of means to obtain information on deficiencies from internal and external sources (customers, suppliers, auditors and control agencies). The existence of means to obtain information on deficiencies from continuous supervision or specific evaluations, which we previously indicated in the First rule of this component. That the detected deficiencies be brought to the attention of the person directly responsible for the activity and of a superior, as soon as possible after verification. That the senior management and the board of directors be informed about those deficiencies of greater complexity and effects on the entity, which must be debated within it. That mechanisms are also created by the entity's management,where compliance with the deficiencies detected and the monitoring of each operation are followed to avoid new problems.

Permanent monitoring includes supervision activities carried out on a constant basis, directly by the different management structures, or through a team of internal auditors, as well as by the Control Committee itself, which must carry out its functions to prevent events that generate losses or costly incidents to the entity from the financial and human point of view.

Separate or individual evaluations are monitoring activities that are performed on a non-routine basis, such as periodic audits by internal auditors. The objective of this component is to ensure that Internal Control works properly, through two types of supervision: continuous activities or specific evaluations. Consequently, some of the issues to consider for this are:

Constitution of the Control Committee integrated, at least, by a top-level leader and the internal auditor. Its objective would be to monitor the proper functioning of the Internal Control System and its continuous improvement. In organizations that justify it, the existence of Internal Audit Units with a sufficient degree of independence and professional qualification.

There are multiple activities that serve to monitor the effectiveness of internal control in the ordinary course of operations, including regulatory acts of administration and supervision, comparisons, conciliations and other routine actions.

Internal control evaluations vary in scope and frequency, depending on the significance of the risks being controlled and the importance of controls in reducing them. Controls that target high priority risks and those most critical to reducing a given risk will tend to be evaluated more frequently. The evaluation of a complete internal control system that will be needed less frequently than the evaluation of specific controls can be motivated by several reasons: main strategy or administrative change, acquisitions and dispositions, or significant changes in operations or methods of processing financial information. When a decision is made to evaluate an entity's complete internal control system,Attention should be directed to each of the internal control components with respect to all significant activities.

Supervision and Monitoring is the process that evaluates the quality of Internal Control over time. That is why the monitoring determines if the Internal control is operating as expected and according to the necessary modifications in each case.

The monitoring process includes evaluating, at appropriate levels, the design, operation, and manner in which measures are taken to update or correct it. Supervision of internal control systems is necessary, evaluating the quality of their performance. This monitoring will take the form of continuous supervision activities, periodic evaluations or a combination of the above. Continuous supervision is part of current activities and includes regular controls carried out by management, as well as certain tasks carried out by staff in the performance of their duties.

The scope and frequency of spot evaluations will be determined primarily based on a risk assessment and the ongoing monitoring efficiency. The deficiencies in the internal control system, where appropriate, must be brought to the attention of management and matters of importance will be reported to the first level of management and the board of directors. Supervision applies to all important activities of the entity (classified as those that generate added value, infrastructure, management, and financial processes), even in the case of contracted external services.

Internal control systems, and sometimes the way controls are applied, evolve over time, so procedures that were effective at any given time may lose their effectiveness or may no longer apply. The causes may be the incorporation of new employees, defects in information and supervision, restrictions on time and resources, and additional pressures.

Likewise, the circumstances on the basis of which the internal control system was initially configured may also change, reducing its ability to warn of the risks caused by the new circumstances; management will have to determine if the internal control system is entirely adequate and its ability to assimilate new risks.

The oversight process ensures that internal control continues to function properly. This process includes the evaluation, by employees of an adequate level, of the way in which the controls have been designed, of their operation, and of the way in which the necessary measures are adopted. It will be applied to all activities within the entity and sometimes also to external contractors. Supervisory operations are carried out in two ways: continuous activities or specific evaluations. Normally, internal control systems ensure, to a greater or lesser extent, their own supervision.

In this sense, the higher the level and the effectiveness of the continuous supervision, the less will be the need for specific evaluations. The frequency of timely evaluations necessary for management to have reasonable assurance of the effectiveness of the internal control system is left to management's discretion. When determining this frequency, the following should be taken into account: the nature and importance of the changes and the risks they entail, the competence and experience of the people who apply the controls, as well as the results achieved by the supervision continued. A combination of continuous supervision and timely evaluations usually ensures that the efficiency of the internal control system is maintained.

It should be recognized that the entity's normal and recurring activities incorporate continuous supervision procedures that, carried out in real time and rooted in the entity, respond dynamically to the circumstances of the moment. Consequently, they are more effective than the procedures applied in the independent evaluation, this is carried out a posteriori, so that the continuous follow-up allows identifying possible problems more quickly.

However, some entities with stable activities of continuous supervision carry out independent evaluations of their internal control system or parts of it, on a regular basis (for example, rotating in several years). If the entity sees the need for frequent spot evaluations, it should focus its efforts on improving continuous supervision activities, with more emphasis on integrated controls than on complementary controls.

1.10.-Modalities of supervision

Continuous Activities: Those incorporated into normal or recurring activities that, running over time and rooted in management, generate dynamic responses to the circumstances that persist in the entity. Specific Evaluations: They are determined by the nature and importance of the changes and risks, despite the fact that discipline and the rigor of what is established in each case are maintained.

1.11.-Evaluation Tools for Continuous Monitoring

The workers know and execute their functions according to what is established. Constant evaluation of internal and third-party information received. Existence of checks of mechanisms and functions with others in order. Responses given to the recommendations of the auditors. The need for staff training in areas and positions where necessary. The periodic evaluation of the personnel regarding their functions, and what should be known from the ethical and behavioral point of view. Effective analysis of the results of the work carried out by internal auditors. The extent to which personnel, in carrying out their normal activities, obtain evidence that the internal control system is working properly.To what extent communications from third parties corroborate internally generated information or indicate problems. Periodic comparisons between the amounts recorded by the accounting system with physical assets. To what extent training seminars, planning sessions, and other meetings provide management with information on whether controls are operating effectively. Efficacy of internal audit activities.

1.12.-Assessment Tools for Spot Assessments

The scope and frequency of Specific Evaluations of the Internal Control System must be established. The existence of valid evaluation processes in correspondence with the need for the position. Use of grounded mechanisms and in correspondence with the characteristics of the entity.

Internal Control Program

goals

Verify in the audited entities the compliance with the current legislation. Verify that the Generally Accepted Accounting Principles and Internal Control are complied with, as well as the legitimacy of the operations, their valuation and correct accounting. Verify that the accounting information to guarantee its effectiveness. in managerial decision-making and to meet its objectives, it meets the following qualities: utility, identification, opportunity, representativeness, creativity, reliability, verifiability and homogeneity.

The foregoing does not exclude other audit programs on certain topics, such as: Foreign Exchange, Events, Cooperations, etc. that also contemplate issues related to Internal Control and that are included in this Chapter identified with other document numbers.

Procedures

1. Exploration

This stage is explained in detail in this chapter, however, the most important aspects that must be known are indicated below:

Details of the entity, organizational structure and corporate purpose. Fundamental activities. Leaders and officials linked to the different activities and dates on which they took office. Functions of structural divisions. Powers of the bosses at the different structural levels. Template of corresponding positions and salaries. Collective management bodies in the entity. Main transformations in the organization of the production of goods and services. Organization of the quality management activity. Organization of labor and salary policy. Salary systems that are applied in the entity. Organization of accounting. Organization of cost activity. Organization of finance activity. Organization of the internal control activity. Planning organization.Organization of the economic contracting activity. Organization of the marketing activity. Man care system. Information system.

As an additional element, the auditor should check if the entity is subscribed or if it has prepared the manuals of General Accounting Standards and Financial Legislation; if so, check if they are up to date.

General measures to achieve good internal control

To process each type of transaction, internal control must go through four separate stages, being the following:

Authorized. Approved. Executed. Registered.

The division of labor is perhaps the most important element in achieving adequate internal control.

Proper separation of duties limits the chances of fraud and also improves the accuracy of accounting records. This crucial, but often neglected, component of the internal control system can be subdivided into four parts:

Separation of accounting operations. The accounting function must be totally separated from the operating departments, in order to maintain objective records. Separation of the custody of the assets, from the records of these in the accounting. Corresponding assets, whenever possible. Responsibilities should be assigned in such a way that no person or department handles a complete transaction from start to finish.

It is alerted to the possibility that there are regulations issued by the higher level of the entity on the particularities of the activity and that the auditor must obtain; what would allow him to extend the spectrum to review in the field.

Relevant issues to verify by components and standards.

Component No. 1 Control Environment

Program

• Verify if the following documents exist:

Implementation schedule of Resolution No. 297/03 "Definitions of Internal Control" of the Ministry of Finance and Prices, duly approved by the empowered authority. Resolution of constitution of the entity and approved corporate purpose. Resolutions of constitution of the management bodies and consultative.Resolution of constitution of the Internal Control Committee. Functions and objectives. Collective labor agreement. Procedures and Organization Manual. General Accounting Manual. Cost Accounting Manual. Internal regulations, code of conduct and code of ethics. Minutes of the Board of Directors. Minutes of the general meetings with workers for efficiency analysis Main contracts and obligations Approved template Organizational structure and diagram Job designin accordance with current labor legislation. Policy on selection and recruitment of staff. Training plan. Strategic projection. Work objectives. Measurement criteria. Income and Expense Plan. Financial statements and fundamental economic indicators. Internal Audit Plan approved by the appropriate party.

Standards for the Control Environment.

Integrity and ethical values.

Program

Inquire whether the leaders and workers know the codes of conduct, ethics or disciplinary regulations established in the entity. Verify the signing of the applicable codes of ethics. Verify if any manager or worker who has failed to comply with the provisions of the aforementioned legal provisions has applied the corresponding measures, and if they are known to the rest of the workers, in the cases that proceed.

Professional competence.

Program

Check if there are procedures for the selection, training, formation, evaluation and promotion of the necessary human resources in the entity, as well as that they are defined, clearly and explicitly, the contents of each job and related activities and the required knowledge.

Atmosphere of mutual trust.

Program

Check if minutes are issued by the different forms of meeting used in the organization (Boards of Directors, offices, Union Assemblies, among others), and if compliance is controlled by those responsible. Verify as part of the methods and management styles, if those responsible for the agreements are accountable for their management at the corresponding level. Check if there are communication channels for the workers to present their suggestions on improvements or possible changes that provide compliance with tasks and goals.

Organization chart.

Program

Check if there is an organizational chart that defines the organizational structure, functions and responsibilities, and if it is duly updated, so that it fulfills the mission and objectives of the entity. Check if the key processes are defined and who are in charge of its correct operation.

Assignment of authority and responsibility.

Program

• Check if there is an organization manual or organic regulation that specifies, at least, the following aspects:

Objectives and functions of the different areas of responsibility of the entity; authority and responsibility of the different jobs; and the actions and positions of the different hierarchical and functional relationships of the entity.

• Verify also, if each manager and worker has defined in writing his duties, rights and material responsibility for the resources he guards.

Personnel policies and practices.

Program

Check the updating and compliance of the established procedures for the selection, training, formation, rotation, promotion, evaluation of the performance of the personnel, and sanctions to apply according to the current labor legislation.

Control Committee.

Program

Verify if the Control Committee is constituted, if so, check if it fulfills the functions assigned to it in relation to monitoring the proper functioning and continuous improvement of the Internal Control System implemented in the entity.

Component No. 2 Risk Assessment.

Rules for Risk Assessment.

Identification and Estimation of Risk; Determination of the Control Objectives; and Detection of Change.

Program

• Check if the entity has identified the risks related to the domains or key points of the organization in: internal, external and its own activity.

• Verify if the factors or sources that most affect them were taken into account in the risk identification process.

• Check if the identification of risks defines specific indicators for the valuation of the loss. Some examples could be:

prices of raw materials, materials, goods for sale, related to production or service processes, which are related to the identified risk; unit income not received from the provision of services or the sale of finished production; amounts of penalties or fines provided by law for non-compliance; average unit wage paid to workers; and overpayment due to the occurrence of the identified risk.

• Verify if control objectives are specified based on defined internal, external and activity risks.

• Verify if the Risk Assessment process is kept up-to-date, so that they do not lose validity, or new risks are included.

Component No. 3 Control Activities

Control Activities Standards

These standards must be included, at least, in manuals that contain the procedures related to: Internal Control, General Accounting and Cost Accounting; which in each case must be prepared by the entity.

• Verify that the referred manuals define:

Model development area. Destination of copies, if applicable. Holding time. Conservation place of each model or document.

Procedures and Organization Manual

Program

• Check that it contains the procedures related to:

Separation of tasks and responsibilities; or failing that, the form of supervision or monitoring. Coordination between areas. Documentation. Defined levels of leadership. Timely and adequate registration of transactions and events. Restricted access to resources, assets and records. Rotation of personnel in key tasks. Control of the information system. Indicators of performance. Internal Audit Function, in accordance with current regulations.

General Accounting Manual

Program

• Examine that includes:

Organization of the accounting register, subdivisions for the registration of primary information (area, department, divisions, among others). Main operating characteristics if you use the accounting system supported on information technology. Details of the system used for the processing of the accounting register and of the issuance of the information derived from the same.Nomenclator of accounts, which specifies the accounts, subaccounts and analyzes, both of general and specific use, that must be used in the entity, according to the activities it carries out and the mode of processing of the information.Definition of the content and use of the accounts, subaccounts and analyzes.Design of the financial statements of the entity.Accounting procedures to apply, based on the regulations issued by global and branch organizations,the specific ones of each entity, attending to the particularities of its activity and the requirements of its organization and direction.

These procedures may contain illustrative examples of the accounting record of the economic event; and design of the set of models and documents that need to be used in the entity.

Cost Accounting Manual

Program

• Check that it contains:

Cost Accounting System consistent with current regulations on this matter. List of cost centers, expenses, areas of responsibility or other existing structures in the entity. Expense elements, cost items and basic grouping to be used in the entity and its description. Distribution and application of indirect expenses, specifying the distribution bases to be used in said expenses. Procedure for determining the equivalent units (when applicable). Determine methods of costing by-products, waste, recoverable or non-defective productions, among others.; and design of the set of models and specific documents for planning, determining and analyzing the entity's cost, in accordance with the particularities of the activities carried out by the entity.

Control Activities: Financial Management

Treasury or Cash

Program

Verify bank reconciliations of the enabled accounts. Review cash deposits pending deposit and review of the supporting documents. Verify the timely registration and deposit of all cash income, in accordance with the established terms. Verify if cash disbursements are made for authorized items. Review periodic cash amounts, according to the plan approved by the empowered authority, in accordance with current legislation. Verify the existence of a timely record of cash payments, in accordance with current financial and banking legislation. Check that there are payments only for purchases duly authorized by the empowered authority. Verify the proper custody and filing of cash and the corresponding accounting records.Verify compliance with the payment schedule approved by the empowered authority. Verify compliance with the collection policy approved by the empowered authority. Verify the evaluation of the use of financing sources and their impact on the entity's liquidity. See if the Accountability Acts are signed by the person responsible for the custody of the resources. Review the records of shortages, losses and monetary surpluses, what treatment is given and see if they are in accordance with current legislation. Review if the tasks and responsibilities related to transactions and events are authorized, registered and reviewed by different people, in duly justified cases.Verify compliance with the collection policy approved by the empowered authority. Verify the evaluation of the use of financing sources and their impact on the entity's liquidity. See if the Accountability Acts are signed by the person responsible for the custody of the resources. Review the records of shortages, losses and monetary surpluses, what treatment is given and see if they are in accordance with current legislation. Review if the tasks and responsibilities related to transactions and events are authorized, registered and reviewed by different people, in duly justified cases.Verify compliance with the collection policy approved by the empowered authority. Verify the evaluation of the use of financing sources and their impact on the entity's liquidity. See if the Accountability Acts are signed by the person responsible for the custody of the resources. Review the records of shortages, losses and monetary surpluses, what treatment is given and see if they are in accordance with current legislation. Review if the tasks and responsibilities related to transactions and events are authorized, registered and reviewed by different people, in duly justified cases.See if the Accountability Acts are signed by the person responsible for the custody of the resources. Review the records of shortages, losses and monetary surpluses, what treatment is given and see if they are in accordance with current legislation. Review if the tasks and responsibilities related to transactions and events are authorized, registered and reviewed by different people, in duly justified cases.See if the Accountability Acts are signed by the person responsible for the custody of the resources. Review the records of shortages, losses and monetary surpluses, what treatment is given and see if they are in accordance with current legislation. Review if the tasks and responsibilities related to transactions and events are authorized, registered and reviewed by different people, in duly justified cases.

Accounts Receivable

Program

Verify the custody and filing of the blank invoice models and their consecutive numbering. Verify the custody and file of the control of the canceled invoices and definition of the cause (s). Make a confirmation of collections with selected clients, as established in current legislation. See if the commercial invoices issued correspond to the items sent and received by the customer. Review if there is a timely record of commercial invoices, whose shipments are authorized by the empowered authority. Verify if the balances that the accounts receivable show are duly supported by the commercial invoices actually sent to the customer. Verify if the advance collections are properly controlled and supported by the corresponding documents.Verify the custody and correct filing of client files, as well as documentary evidence of collection efforts. Check that the tasks and responsibilities related to transactions and events are authorized, registered and reviewed by different people, in duly justified cases.

Fixed assets

Program

Verify that there is an exact record of purchases and movements of tangible and intangible fixed assets, duly supported by the corresponding primary documentation. Perform a physical count per sample of fixed assets. Review compliance with safeguard measures against the possible loss of fixed assets. Review the Responsibility minutes and see if they are signed by the custodians of these media. Review the treatment given to shortages, losses and surpluses, in accordance with current legislation. Verify if periodic physical counts are made, according to the plan approved by the empowered authority, in accordance with current legislation. Check that the tasks and responsibilities related to transactions and events are authorized, registered and reviewed by different people,in duly justified cases. Review the control of fixed assets by area of responsibility.

Debts to pay

Program

Make a confirmation of payments with selected suppliers, as established in current legislation. Verify if there is an accurate and timely record of purchase invoices duly approved by the empowered authority. Verify that the balances showing the accounts payable are properly supported by the commercial invoices actually received from the supplier. Verify that the advance payments are properly controlled and supported by the corresponding documents. See the Treatment given to claims to suppliers for merchandise not received. Verify proper custody and filing of supplier records. Check that the tasks and responsibilities related to transactions and events are authorized, registered and reviewed by different people,in duly justified cases. Verify if the paid invoices are canceled with the paid stamp.

Payroll

Program

Verify that the wages paid are in accordance with the provisions of the applicable labor legislation. Verify that the exact calculation and registration of payroll (including withholdings to be collected) is in accordance with current legislation and duly approved by the empowered authority. Checking restricted access to payroll data information is for authorized employees and managers only. Verify if there are adequate controls related to the notification of vacations, subsidies and licenses. Check that the tasks and responsibilities related to transactions and events are authorized, registered and reviewed by different people, in duly justified cases. Check if there are undue wages. If there is, check the treatment.Verify the treatment of unclaimed wages if they exist. Verify that the payrolls go through the four stages: authorized, approved, executed and registered.

Valuation of the cost of products or services

Program

Verify if the Cost System approved by the authorized authority is implemented. Verify the execution and compliance of the expense budget by areas of responsibility, as well as the analysis of the causes of the deviations. Verify that the tasks and responsibilities related to transactions and events are authorized, registered and reviewed by different people, in duly justified cases.

Analysis and reconciliations

Program

Review the periodic analysis of the collective management bodies in the execution of the approved budgets and plans, identifying significant variations, trends or changes and their causes. Review the periodic evaluations of the performance indicators approved for the entity and included in its system of Information. Review documentary evidence of reconciliations with customers and suppliers, as well as accounting records.

Financial and management information

Program

Verify that timely delivery of financial and management information is made for decision-making in the collegiate management bodies. Verify the due delivery on the established dates of the financial and management information to the external organs and agencies, as established in the current legislation. Review the correct preparation of the Notes in the Financial Statements (Memory), in accordance with the Cuban Accounting Standards.

Control Activities: Administration and custody of material resources

Purchase of merchandise

Program

• Verify the purchase of merchandise from authorized suppliers, in accordance with current legislation and the contracts signed between the parties.

• Review whether the prices agreed between the parties comply with current legislation.

• Verify if there is updated information on suppliers.

• Verify if there is approval by the purchasing authority, in accordance with current legislation.

Merchandise reception

Program

• Perform a physical count per sample of stored merchandise.

• Verify the complete and timely receipt of the goods received in the warehouses.

• Review the treatment applied to merchandise not shipped by the supplier.

• Review the proper documentation of all transfers received and delivered to and from the warehouse.

• Verify if a prior request is made for the goods to be delivered to production, services or other areas.

• Verify if there is a timely accounting record of the goods made available to production, services, warehouses or other areas.

• Verify if the proper custody and safeguarding of the goods made available to the production, services, warehouses or other areas is carried out.

• Review the Responsibility records and see if they are signed by the people responsible for guarding the goods.

• Verify if the physical and periodic counts are carried out, according to the plan approved by the empowered authority, in accordance with current legislation.

• Verify if adequate treatment is given to shortages, losses and surpluses, in accordance with current legislation.

• Check that the tasks and responsibilities related to transactions and events are authorized, registered and reviewed by different people, in duly justified cases.

• Verify the proper updating of the information related to the primary documents related to the control of merchandise inventories.

• Review the existence of safe working conditions in the storage areas, in accordance with current legislation.

Clearance of goods

Program

• Verify that only applications duly approved by the empowered authority are processed.

• Verify the adequate protection of the stored merchandise.

• Verify the correct handling and storage of the goods, in accordance with the applicable regulations.

• Verify that there are adequate primary records of products stored and available for production, services, customers or other areas.

• Check that the tasks and responsibilities related to transactions and events are authorized, registered and reviewed by different people, in duly justified cases.

Human Resources

Program

• Verify compliance with applicable labor legislation in hiring human resources.

• Verify that there are adequate records to control the attendance and permanence of human resources in the workplace.

• Review the control procedures established for the Forms and Systems of Payment of Wages approved by the Ministry of Labor and Social Security.

• Review compliance with staff rotation policies in key positions.

Information technologies

Program

• Review the certification of the Accounting - Financial System supported on information technologies, duly issued by the Ministries of Finance and Prices and of Information Technology and Communications, where appropriate.

• Verify compliance with current legislation on the protection, security and use of Information Technologies.

Component No. 4 Information and Communication

Information and Communication Standards.

Information and responsibility.

Program

• Review whether the information systems, both manual and computer, used in the entity are duly documented and authorized by the competent authority.

• Check if the responsibility is defined in the review, approval and updating of the information systems used by the organization.

• Verify if directors, department heads, and specialists at each level are provided with the information necessary to fulfill their responsibilities, in accordance with the deadlines established in the entity's information system.

• Examine whether external information is received and issued on time, in accordance with established deadlines.

Content, quality, flow of information and flexibility to change.

Program

• Verify if the entity has designed the information flow (s) and if its content is duly updated, based on changes that have occurred in the entity's internal and external environment, both from a regulatory and organizational point of view..

• Verify compliance with the procedures established in the information system regarding the detection, reception and processing of external information, related to:

Internal and external market conditions Clients and suppliers, both national and foreign Regulatory changes of the organs and agencies of the State Administration empowered to do so.

Communication, organization values and strategies

Program

• Evaluate the impact of the forms of communication of the values and organizational strategies used in the entity, by checking the effectiveness of:

Formal communication channels: related to the operation of the collective management bodies. Non-formal means of communication: related to work and personal relationships between the different areas that make up an entity.

• Confirm that the information systems designed and implemented in the entity facilitate access to the fulfillment of the work objectives and measurement criteria included in the Strategic Planning in the short, medium and long term.

Component # 5: Supervision and Monitoring

Norms of Supervision or Monitoring

Evaluation; Effectiveness; Internal Control System Audits; and treatment of detected deficiencies.

Program

• Verify the existence of the Action Plan (Self-Control Plan) designed in the entity, as well as the analysis, evaluation and review of compliance by those responsible and designated participants. The Action Plan (Self-Control Plan) must include the tasks related to both continuous Activities and specific Evaluations. The effectiveness of the implemented measures must be evaluated.

• Verify that verification of compliance with the Code of Ethics by cadres and officials and the disciplinary regulations applicable to all workers are included in actions at each management level.

• Reconcile the results of the Audit with the vulnerable points identified in the Prevention Plan to corroborate compliance or not with the measures provided by those responsible.

• Evaluate the effectiveness of the Internal Audit function in the entity, based on compliance with current legislation on the subject.

• Assess the entity's response to the recommendations of the internal and external auditors on the measures to strengthen the Internal Control System, in accordance with the results that appear in the Single Audit File enabled in the entity.

• Verify that periodic comparisons are made of the amounts reported by the Accounting System with the assets pending deposit or stored.

• Evaluate the operation of the Control Committee, if it exists, and its impact on the improvement of the processes that make up the Internal Control System in the entity.

Validation of the assumed assumptions

Program

• Confirm that the collective management bodies and other staff participate in periodic evaluations of compliance with the criteria that are implemented in the Management by Objectives and Strategic Planning, in accordance with the following general precepts:

Degree of generalization at different levels of the organization. Level reached in the participation and implication of the leaders and workers up to the base in the fulfillment of the Objectives. Concertation and negotiation to the base in the formulation of the objectives and measurement criteria. System used to control the Objectives. Work done with the desired and shared values of the entity.

• Assess the effectiveness of periodic evaluations with the results of the Audit.

Bibliography

1. ==================. Administration, second part, fifth edition.

2. Bérez Basanta, Alberto. Audit, Havana: Editorial of Books for Education.

3. Carmona, MC., 1998, The Internal Management Audit. The Cuban particular case, PhD Thesis, University of Huelva, Spain.

4. Collective of Authors: "Tools for the Accountant", CECOFIS,

5. Montevideo, Uruguay, 2004, ISBN 959-7185-01.6.

6. Authors Collective: Business Improvement in Cuba, Editorial Felix Varela, Havana, 1999.

7. Authors Collective: Integrated Framework of Internal Control for Latin America, Latin American Federation of Internal Auditors-FLAI, September, 2004.

8. Cooper and Lybrand, 1996, Internal Control, Audit and Computer Security Series, “Internal Control: The Company's Different Responsibilities. Expansión newspaper, Madrid, Spain.

9. Coopers & Lybrand and Institute of Internal Auditors, (1997): COSO Report "The new concepts of Internal Control", USA. ISBN: 84-7978-295-1

10. Executive Committee of the Council of Ministers (1998): Bases for Business Improvement, Cuba.

11. Holmes, Arthur M. Principles of Auditing Hispano-American 1945.

12. Holmes, A. (1994). Principles and Procedures Audit. Editorial Limusa. Mexico

13. International Workshop "Evaluation of Internal Control for the efficiency of the audit function" Caracas-Venezuela July 26-30, 1999, document delivered to the participants.

14. Ministry of Finance and Prices, 1996, Seminar on Internal Audit, Havana, Cuba.

15. Ministry of Finance and Prices (2003): Resolution 297/03 on the Definitions of Internal Control, content of its components and its Standards. Cuba.

16. Audit and control magazine, volume 1, No.1, May-August 2000.

17. Audit and control magazine, volume 1, No.2, September-December 2000.

18. Audit and control magazine, volume 1, No.3, Special Edition 2001.

19. Audit and Control Magazine, No 4/2001.

20. Audit and Control Magazine, No. 5/2002.

21. Audit and Control Magazine, No 7. December, 2002.

22. Miranda, A., de, Torras, O., González, J., (1982), Audit of Socialist Companies. Volume I, Cuba, Editorial Combinado Poligráfico Juan Marinillo.

23. Taylor, Donald H. Audit the Integration of Concepts and Procedures, Mexico, Editorial Lamisa, 1991.

24. www.google.com Audit and Internal Control.

25. www.google.com Audit and Internal Control.

26. www.google.com Audit and Internal Control.